CVE-2026-11407 is a high-severity vulnerability in Pimcore CMS/DXP 12.3.8 involving improper neutralization of special elements in the Twig template engine sandbox. Authenticated administrative attackers can bypass sandbox restrictions because the custom Twig SecurityPolicy's checkMethodAllowed() and checkPropertyAllowed() functions are empty, allowing arbitrary method execution on PHP objects. Malicious Twig templates can be injected via the DataObject ClassDefinition Layout\Text component, enabling arbitrary file reads, database queries, and potentially remote code execution through PHP object gadget chains. The use of a pimcore_* function wildcard expands the scope of this bypass to all Pimcore Twig functions. No patch or official remediation guidance is currently provided.

The vulnerability allows authenticated administrators to execute arbitrary PHP object methods, which can lead to unauthorized file access, execution of arbitrary database queries, and potentially remote code execution. This compromises the confidentiality, integrity, and availability of the affected Pimcore CMS/DXP installations. The high CVSS score (8.6) reflects the significant risk posed by this flaw when exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and avoid using untrusted Twig templates in the DataObject ClassDefinition Layout\Text component. Monitor vendor channels for updates and apply patches promptly once available.